Headers

    The Headers middleware manages the headers of requests and responses.

    A set of forwarded headers are automatically added by default. See the FAQ for more information.

    The following example adds the X-Script-Name header to the proxied request and the X-Custom-Response-Header header to the response

    Docker

    Kubernetes

    1. apiVersion: traefik.containo.us/v1alpha1
    2. kind: Middleware
    3. metadata:
    4.   name: test-header
    5. spec:
    6.   headers:
    7.     customRequestHeaders:
    8.       X-Script-Name: "test"
    9.     customResponseHeaders:
    10.       X-Custom-Response-Header: "value"

    Consul Catalog

    1. - "traefik.http.middlewares.testheader.headers.customrequestheaders.X-Script-Name=test"
    2. - "traefik.http.middlewares.testheader.headers.customresponseheaders.X-Custom-Response-Header=value"

    Marathon

    1. "labels": {
    2.   "traefik.http.middlewares.testheader.headers.customrequestheaders.X-Script-Name": "test",
    3.   "traefik.http.middlewares.testheader.headers.customresponseheaders.X-Custom-Response-Header": "value"
    4. }

    Rancher

    1. labels:
    2.   - "traefik.http.middlewares.testheader.headers.customrequestheaders.X-Script-Name=test"
    3.   - "traefik.http.middlewares.testheader.headers.customresponseheaders.X-Custom-Response-Header=value"

    File (YAML)

    1. http:
    2.   middlewares:
    3.     testHeader:
    4.       headers:
    5.         customRequestHeaders:
    6.         customResponseHeaders:
    7.           X-Custom-Response-Header: "value"

    File (TOML)

    1. [http.middlewares]
    2.   [http.middlewares.testHeader.headers]
    3.     [http.middlewares.testHeader.headers.customRequestHeaders]
    4.         X-Script-Name = "test"
    5.     [http.middlewares.testHeader.headers.customResponseHeaders]
    6.         X-Custom-Response-Header = "value"

    Adding and Removing Headers

    In the following example, requests are proxied with an extra X-Script-Name header while their X-Custom-Request-Header header gets stripped, and responses are stripped of their X-Custom-Response-Header header.

    Docker

    1. labels:
    2.   - "traefik.http.middlewares.testheader.headers.customrequestheaders.X-Script-Name=test"
    3.   - "traefik.http.middlewares.testheader.headers.customrequestheaders.X-Custom-Request-Header="
    4.   - "traefik.http.middlewares.testheader.headers.customresponseheaders.X-Custom-Response-Header="

    Kubernetes

    1. apiVersion: traefik.containo.us/v1alpha1
    2. kind: Middleware
    3. metadata:
    4.   name: test-header
    5. spec:
    6.   headers:
    7.     customRequestHeaders:
    8.       X-Script-Name: "test" # Adds
    9.       X-Custom-Request-Header: "" # Removes
    10.     customResponseHeaders:
    11.       X-Custom-Response-Header: "" # Removes

    Consul Catalog

    Marathon

    1. "labels": {
    2.   "traefik.http.middlewares.testheader.headers.customrequestheaders.X-Script-Name": "test",
    3.   "traefik.http.middlewares.testheader.headers.customrequestheaders.X-Custom-Request-Header": "",
    4.   "traefik.http.middlewares.testheader.headers.customresponseheaders.X-Custom-Response-Header": "",
    5. }

    Rancher

    1. labels:
    2.   - "traefik.http.middlewares.testheader.headers.customrequestheaders.X-Script-Name=test"
    3.   - "traefik.http.middlewares.testheader.headers.customrequestheaders.X-Custom-Request-Header="
    4.   - "traefik.http.middlewares.testheader.headers.customresponseheaders.X-Custom-Response-Header="

    File (YAML)

    1. http:
    2.   middlewares:
    4.       headers:
    5.         customRequestHeaders:
    6.           X-Script-Name: "test" # Adds
    7.           X-Custom-Request-Header: "" # Removes
    8.         customResponseHeaders:
    9.           X-Custom-Response-Header: "" # Removes

    File (TOML)

    1. [http.middlewares]
    2.   [http.middlewares.testHeader.headers]
    3.     [http.middlewares.testHeader.headers.customRequestHeaders]
    4.         X-Script-Name = "test" # Adds
    5.         X-Custom-Request-Header = "" # Removes
    6.     [http.middlewares.testHeader.headers.customResponseHeaders]
    7.         X-Custom-Response-Header = "" # Removes

    Using Security Headers

    Security-related headers (HSTS headers, Browser XSS filter, etc) can be managed similarly to custom headers as shown above. This functionality makes it possible to easily use security features by adding headers.

    Docker

    1. labels:
    2.   - "traefik.http.middlewares.testHeader.headers.framedeny=true"
    3.   - "traefik.http.middlewares.testHeader.headers.browserxssfilter=true"

    Kubernetes

    1. apiVersion: traefik.containo.us/v1alpha1
    2. kind: Middleware
    3. metadata:
    4.   name: test-header
    5. spec:
    6.   headers:
    7.     frameDeny: true
    8.     browserXssFilter: true

    Consul Catalog

    1. - "traefik.http.middlewares.testheader.headers.framedeny=true"
    2. - "traefik.http.middlewares.testheader.headers.browserxssfilter=true"

    Marathon

    1. "labels": {
    2.   "traefik.http.middlewares.testheader.headers.framedeny": "true",
    3. }

    Rancher

    File (YAML)

    1. http:
    2.   middlewares:
    3.     testHeader:
    4.       headers:
    5.         frameDeny: true
    6.         browserXssFilter: true

    File (TOML)

    1. [http.middlewares]
    2.   [http.middlewares.testHeader.headers]
    3.     frameDeny = true
    4.     browserXssFilter = true

    CORS Headers

    CORS (Cross-Origin Resource Sharing) headers can be added and configured in a manner similar to the custom headers above. This functionality allows for more advanced security features to quickly be set. If CORS headers are set, then the middleware does not pass preflight requests to any service, instead the response will be generated and sent back to the client directly.

    Docker

    1. labels:
    2.   - "traefik.http.middlewares.testheader.headers.accesscontrolallowmethods=GET,OPTIONS,PUT"
    3.   - "traefik.http.middlewares.testheader.headers.accesscontrolalloworiginlist=https://foo.bar.org,https://example.org"
    4.   - "traefik.http.middlewares.testheader.headers.accesscontrolmaxage=100"
    5.   - "traefik.http.middlewares.testheader.headers.addvaryheader=true"
    1. apiVersion: traefik.containo.us/v1alpha1
    2. kind: Middleware
    3. metadata:
    4.   name: test-header
    5. spec:
    6.   headers:
    7.     accessControlAllowMethods:
    8.       - "GET"
    9.       - "OPTIONS"
    10.       - "PUT"
    11.     accessControlAllowOriginList:
    12.       - "https://foo.bar.org"
    13.       - "https://example.org"
    14.     accessControlMaxAge: 100
    15.     addVaryHeader: true

    Consul Catalog

    1. - "traefik.http.middlewares.testheader.headers.accesscontrolallowmethods=GET,OPTIONS,PUT"
    2. - "traefik.http.middlewares.testheader.headers.accesscontrolalloworiginlist=https://foo.bar.org,https://example.org"
    3. - "traefik.http.middlewares.testheader.headers.accesscontrolmaxage=100"
    4. - "traefik.http.middlewares.testheader.headers.addvaryheader=true"

    Marathon

    1. "labels": {
    2.   "traefik.http.middlewares.testheader.headers.accesscontrolallowmethods": "GET,OPTIONS,PUT",
    3.   "traefik.http.middlewares.testheader.headers.accesscontrolalloworiginlist": "https://foo.bar.org,https://example.org",
    4.   "traefik.http.middlewares.testheader.headers.accesscontrolmaxage": "100",
    5.   "traefik.http.middlewares.testheader.headers.addvaryheader": "true"
    6. }

    Rancher

    1. labels:
    2.   - "traefik.http.middlewares.testheader.headers.accesscontrolallowmethods=GET,OPTIONS,PUT"
    3.   - "traefik.http.middlewares.testheader.headers.accesscontrolalloworiginlist=https://foo.bar.org,https://example.org"
    4.   - "traefik.http.middlewares.testheader.headers.accesscontrolmaxage=100"
    5.   - "traefik.http.middlewares.testheader.headers.addvaryheader=true"

    File (YAML)

    1. http:
    2.   middlewares:
    3.     testHeader:
    4.       headers:
    5.         accessControlAllowMethods:
    6.           - GET
    7.           - OPTIONS
    8.           - PUT
    9.         accessControlAllowOriginList:
    10.           - https://foo.bar.org
    11.           - https://example.org
    12.         accessControlMaxAge: 100
    13.         addVaryHeader: true

    File (TOML)

    Configuration Options

    General

    Warning

    Custom headers will overwrite existing headers if they have identical names.

    The detailed documentation for security headers can be found in unrolled/secure.

    customRequestHeaders

    The customRequestHeaders option lists the header names and values to apply to the request.

    customResponseHeaders

    The customResponseHeaders option lists the header names and values to apply to the response.

    accessControlAllowCredentials

    The accessControlAllowCredentials indicates whether the request can include user credentials.

    accessControlAllowHeaders

    The indicates which header field names can be used as part of the request.

    accessControlAllowMethods

    The accessControlAllowMethods indicates which methods can be used during requests.

    accessControlAllowOriginList

    The accessControlAllowOriginList indicates whether a resource can be shared by returning different values.

    A wildcard origin * can also be configured, and matches all requests. If this value is set by a backend service, it will be overwritten by Traefik.

    This value can contain a list of allowed origins.

    More information including how to use the settings can be found at:

    Traefik no longer supports the null value, as it is no longer recommended as a return value.

    accessControlAllowOriginListRegex

    The accessControlAllowOriginListRegex option is the counterpart of the accessControlAllowOriginList option with regular expressions instead of origin values. It allows all origins that contain any match of a regular expression in the accessControlAllowOriginList.

    Tip

    Regular expressions and replacements can be tested using online tools such as Go Playground or the .

    When defining a regular expression within YAML, any escaped character needs to be escaped twice: example\.com needs to be written as example\\.com.

    The accessControlExposeHeaders indicates which headers are safe to expose to the api of a CORS API specification.

    accessControlMaxAge

    The accessControlMaxAge indicates how many seconds a preflight request can be cached for.

    addVaryHeader

    The addVaryHeader is used in conjunction with accessControlAllowOriginList to determine whether the Vary header should be added or modified to demonstrate that server responses can differ based on the value of the origin header.

    allowedHosts

    The allowedHosts option lists fully qualified domain names that are allowed.

    hostsProxyHeaders

    The hostsProxyHeaders option is a set of header keys that may hold a proxied hostname value for the request.

    sslRedirect

    Warning

    Deprecated in favor of EntryPoint redirection or the .

    sslTemporaryRedirect

    Warning

    Deprecated in favor of or the RedirectScheme middleware.

    Set sslTemporaryRedirect to true to force an SSL redirection using a 302 (instead of a 301).

    sslHost

    Warning

    Deprecated in favor of the RedirectRegex middleware.

    The sslHost option is the host name that is used to redirect HTTP requests to HTTPS.

    sslProxyHeaders

    The sslProxyHeaders option is set of header keys with associated values that would indicate a valid HTTPS request. It can be useful when using other proxies (example: "X-Forwarded-Proto": "https").

    sslForceHost

    Warning

    Deprecated in favor of the .

    Set sslForceHost to true and set sslHost to force requests to use SSLHost regardless of whether they already use SSL.

    stsSeconds

    The stsSeconds is the max-age of the Strict-Transport-Security header. If set to 0, the header is not set.

    stsIncludeSubdomains

    If the stsIncludeSubdomains is set to true, the includeSubDomains directive is appended to the Strict-Transport-Security header.

    Set stsPreload to true to have the preload flag appended to the Strict-Transport-Security header.

    forceSTSHeader

    Set forceSTSHeader to true to add the STS header even when the connection is HTTP.

    frameDeny

    Set frameDeny to true to add the X-Frame-Options header with the value of DENY.

    customFrameOptionsValue

    The customFrameOptionsValue allows the X-Frame-Options header value to be set with a custom value. This overrides the FrameDeny option.

    contentTypeNosniff

    Set contentTypeNosniff to true to add the X-Content-Type-Options header with the value nosniff.

    browserXssFilter

    Set browserXssFilter to true to add the X-XSS-Protection header with the value 1; mode=block.

    customBrowserXSSValue

    The customBrowserXssValue option allows the X-XSS-Protection header value to be set with a custom value. This overrides the BrowserXssFilter option.

    contentSecurityPolicy

    The contentSecurityPolicy option allows the Content-Security-Policy header value to be set with a custom value.

    publicKey

    The publicKey implements HPKP to prevent MITM attacks with forged certificates.

    referrerPolicy

    The referrerPolicy allows sites to control whether browsers forward the Referer header to other sites.

    featurePolicy

    Warning

    Deprecated in favor of permissionsPolicy

    The featurePolicy allows sites to control browser features.

    permissionsPolicy

    The permissionsPolicy allows sites to control browser features.

    Set isDevelopment to true when developing to mitigate the unwanted effects of the AllowedHosts, SSL, and STS options. Usually testing takes place using HTTP, not HTTPS, and on , not your production domain. If you would like your development environment to mimic production with complete Host blocking, SSL redirects, and STS headers, leave this as false.

    Using Traefik for Business Applications?

    If you are using Traefik for commercial applications, consider the . You can use it as your: